Wireshark · Wireshark-users: Re: [Wireshark-users] Wireshark on Ubuntu with IWL3945 captures only management traffic when in moni

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 21, 2008, at 11:37 AM, puller puller wrote:

> Dear wireshark users,
> I'm having issues with my Intel 3945a/b/g wireless NIC on Ubuntu  
> Linux with IWL3945 drivers, when trying to collect packets from my  
> WPA protected wireless network.
> If I don't set the NIC in monitor mode, I correctly get all data  
> packets related to me and all broadcast traffic (obviously no  
> traffic related to other hosts). In this case I still remain  
> connected to my network.
> If i set the NIC in monitor mode, I can get only beacons and probes  
> (management traffic), and no data packets at all. In this case I  
> cannot stay connected to my network.

For at least some wireless adapters and at least some of their drivers  
on at least some OSes, that will be the case - putting the adapter  
into monitor mode will disassociate it from any network with which  
it's associated.

It might also be that the adapter or driver will discard packets it  
can't decrypt, or something strange such as that.  I'd suggest asking  
about it on either a general Linux wireless list or a list for that  
card or driver.